hsh-cli 0.0.10

Command-line companion for the `hsh` password-hashing library: hash / verify / rehash / inspect / calibrate.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

#![allow(missing_docs)]
#![allow(clippy::unwrap_used, clippy::expect_used)]
// Copyright © 2023-2026 Hash (HSH) library contributors. All rights reserved.
// SPDX-License-Identifier: Apache-2.0 OR MIT

//! Snapshot tests for the operator-facing `hsh` CLI output.
//!
//! The human-readable format of `hsh inspect` and the calibration
//! ladder is part of the CLI's *contract* — operators pipe it through
//! `grep`/`awk`. A whitespace or column-header change would silently
//! break those pipelines. `insta` locks the format down; intentional
//! changes go through `cargo insta review`.
//!
//! Snapshots live at `crates/hsh-cli/tests/snapshots/`.
//!
//! Note: snapshot fixtures that depend on host-specific data (timings,
//! random salts) are filtered through `insta::dynamic_redaction` so the
//! snapshot itself stays deterministic across machines and CI hosts.

use std::process::{Command, Stdio};

fn hsh() -> Command {
    let bin = env!("CARGO_BIN_EXE_hsh");
    Command::new(bin)
}

fn run_check_stdout(args: &[&str]) -> String {
    let output = hsh()
        .args(args)
        .stdout(Stdio::piped())
        .stderr(Stdio::piped())
        .output()
        .expect("spawn hsh");
    assert!(
        output.status.success(),
        "hsh exited non-zero: {}\nstderr: {}",
        output.status,
        String::from_utf8_lossy(&output.stderr),
    );
    // Normalize line endings so the Windows runner (CRLF on stdout for
    // clap's help output) produces the same snapshot as Linux / macOS.
    String::from_utf8(output.stdout)
        .expect("utf-8 stdout")
        .replace("\r\n", "\n")
}

// ---------------------------------------------------------------------------
// `hsh inspect` on a known-good Argon2id PHC fixture.
// The fixture below is a deterministic vector — same salt, same params,
// same output across every host.
// ---------------------------------------------------------------------------

const ARGON2ID_FIXTURE: &str = "$argon2id$v=19$m=19456,t=2,p=1$c2FsdHNhbHRzYWx0$\
     ZJG8Sl9MhEd84QPshSeWLNVnPLBPp9DiOhcPjT0bDqQ";

#[test]
fn inspect_argon2id_phc_format() {
    let stdout = run_check_stdout(&["inspect", ARGON2ID_FIXTURE]);
    // Strip lines that could carry host-specific data (none expected
    // here, but defence in depth). Snapshot the rest.
    insta::assert_snapshot!("inspect_argon2id_phc", stdout);
}

// ---------------------------------------------------------------------------
// `hsh inspect` on a known-good bcrypt MCF fixture.
// ---------------------------------------------------------------------------

const BCRYPT_FIXTURE: &str =
    "$2b$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy";

#[test]
fn inspect_bcrypt_mcf_format() {
    let stdout = run_check_stdout(&["inspect", BCRYPT_FIXTURE]);
    insta::assert_snapshot!("inspect_bcrypt_mcf", stdout);
}

// ---------------------------------------------------------------------------
// `hsh --help` — top-level usage block.
// Locks in the subcommand listing so a CLI restructure can't ship
// without a deliberate snapshot review.
//
// Unix-only: clap's `--help` output on Windows differs in the program
// path it prints (e.g. \"hsh.exe\" vs \"hsh\") and in incidental
// ANSI-handling, so the snapshot would never match a POSIX baseline.
// The non-help snapshot tests above (`inspect <fixture>`) still run
// on every OS — they test our own format, not clap's.
// ---------------------------------------------------------------------------

#[cfg(unix)]
#[test]
fn help_top_level_layout() {
    let stdout = run_check_stdout(&["--help"]);
    insta::assert_snapshot!("help_top_level", stdout);
}

#[cfg(unix)]
#[test]
fn help_hash_subcommand_layout() {
    let stdout = run_check_stdout(&["hash", "--help"]);
    insta::assert_snapshot!("help_hash", stdout);
}

#[cfg(unix)]
#[test]
fn help_verify_subcommand_layout() {
    let stdout = run_check_stdout(&["verify", "--help"]);
    insta::assert_snapshot!("help_verify", stdout);
}